Handbooks / Computer Networks / Chapter 3
TCP vs UDP
7 pages · ~5 min✓ Reviewed
Builds on IP Addressing and Subnetting. Next up: DNS.
Transport Layer Mental Model: Ports, Sockets, TCP vs UDP
1. Layers and Ports
- IP: host-to-host delivery
- Transport: process-to-process delivery
- Port = 16-bit number, 0-65535
| Range | Name |
|---|---|
| 0-1023 | Well-known |
| 1024-49151 | Registered |
| 49152-65535 | Ephemeral |
2. Sockets and the 4-tuple
- Socket = IP address + port
- TCP connection = 4-tuple: src IP, src port, dst IP, dst port
- One listening port serves many clients: each connection has a different 4-tuple
- Same client IP, ports 50001 and 50002 to server :443 = two connections
3. TCP vs UDP
| TCP | UDP | |
|---|---|---|
| Setup | Connection-oriented | Connectionless |
| Delivery | Reliable, ordered | Unreliable |
| Unit | Byte stream | Datagrams |
Port is not connection
A port names a process. Only the 4-tuple names a TCP connection.
TCP Handshake and Teardown
1. Three-Way Handshake
- SYNclient, seq=x
- SYN-ACKserver, seq=y, ack=x+1
- ACKclient, ack=y+1
- SYN and FIN each consume one sequence number
- True even when the segment carries no data
2. Teardown
- 1FINactive closer
- 2ACKpeer
- 3FINpeer
- 4ACKactive closer
- 5TIME_WAIT2×MSL
- Four steps: each direction closes independently (half-close)
- Active closer holds TIME_WAIT for 2×MSL (about 60s)
- Why: late packets expire, and the final ACK can be resent
3. Abort with RST
- RST aborts a connection immediately
- Sent when a segment arrives for a closed port
- Also sent on a fatal error
Remember
TIME_WAIT sits on the side that closes first (the active closer), whether client or server.
Sequence Numbers and ACKs
1. Seq and ACK
- Seq = byte offset of the segment's first data byte, not a segment counter
- ACK = next byte the receiver expects (cumulative acknowledgement)
| Sender sends | Receiver replies |
|---|---|
| seq=1000, 500 bytes | ack=1500 (1000 + 500) |
2. ISN and Fast Retransmit
- ISN is random per connection
- Stale packets from an old connection are not accepted as new
- Blind spoofing becomes hard to guess
- 3 duplicate ACKs → retransmit at once, no wait for the RTO
Same numbers as the example
- 1seq=1500 lost500 bytes
- 2seq=2000 arrivesack=1500
- 3seq=2500 arrivesack=1500
- 4seq=3000 arrivesack=1500
- 5Resend seq=1500after 3 dup ACKs
Remember
ACK names the next byte wanted, never the last byte received.
3. Interview Point
- Is seq a segment counter? No, it is a byte offset.
- seq=1000 with 500 bytes: which ack? ack=1500, the next expected byte.
- Why retransmit on 3 duplicate ACKs? It signals loss early, skipping the RTO wait.
Flow Control: Sliding Window
1. The Sender's Limit
- Flow control protects the receiver
- Receiver puts its free buffer in every ACK as rwnd
cwnd= sender's own congestion window, a network-side limit (see congestion control)- In flight ≤ min(rwnd, cwnd) unacknowledged bytes
2. Sliding and Stalling
- Sendup to window
- ACK arrivesbytes confirmed
- Window slides rightleft edge moves
- Send new bytesspace opened
- rwnd = 0 stalls the sender
- It sends zero-window probes until the receiver reopens the window
3. Big Windows
- Window field is 16 bits: max 65535 bytes
- Too small on high bandwidth-delay links: the pipe never fills
- Window scaling option: window = field × 2^shift, shift up to 14
Two limits
rwnd protects the receiver, cwnd protects the network. The sender obeys the smaller.
Congestion Control: Slow Start and AIMD
1. Two Limits
| rwnd | cwnd | |
|---|---|---|
| Protects | receiver (flow control) | network (congestion control) |
| Kept by | receiver, sent in ACKs | sender, its own |
2. cwnd Over Time
100
201
402
803↑ ssthresh
814
825
416↑ loss
cwnd in MSS per RTT: doubling, then +1, then drop
- Slow start: cwnd ~10 MSS, doubles every RTT until ssthresh
- AIMD: +1 MSS per RTT (additive increase)
- Multiplicative decrease: on loss, ssthresh = cwnd/2
- Example: loss at cwnd 82 gives ssthresh = 41
3. Loss Reaction
timeout3 dup ACKs (Reno)
Common mistake
rwnd is the receiver limit; cwnd is the network limit. Never swap them.
4. Interview Point
- Why double in slow start? It probes capacity fast; the window grows by ACKs received.
- rwnd vs cwnd? Receiver limit vs network limit; the sender uses the smaller.
- Timeout vs 3 dup ACKs? Timeout resets to 1 MSS; dup ACKs only halve cwnd.
TCP vs UDP Cheat Sheet
1. Pick the protocol
| UDP | TCP | |
|---|---|---|
| Header | 8 B: src port, dst port, length, checksum | 20 B+ |
| Model | connectionless datagrams | reliable ordered stream |
| Use for | DNS, VoIP, video, games, DHCP, QUIC | HTTP/1-2, SSH, SMTP, file transfer |
| Because | low latency; loss tolerable or app-handled | need reliability and ordering |
2. Inspect and debug
| Command | Shows |
|---|---|
ss -tan | TCP states |
ss -ulpn | UDP listeners |
nc -zv host port | port check |
- 'Address already in use' = port bound or in TIME_WAIT
- Servers: set
SO_REUSEADDRbefore bind
3. Quick recall
- SYNclient
- SYN-ACKserver
- ACKclient
- ACK = next expected byte
- Window = min(rwnd, cwnd)
- Slow start doubles per RTT, then AIMD
Two windows
rwnd protects the receiver; cwnd protects the network. Never mix them up.
Check yourself
Each segment carries 500 bytes. seq=1000 arrives, seq=1500 is lost, then seq=2000, 2500 and 3000 arrive. What ACKs come back?
- seq=1000 gives ack=1500, the next expected byte
- seq=2000, 2500 and 3000 each give ack=1500 again (duplicates 1, 2, 3)
- Three duplicates trigger fast retransmit of seq=1500, with no RTO wait
rwnd=8000, cwnd=20000, 5000 bytes unacknowledged. How many more bytes can be sent?
- Limit is min(rwnd, cwnd) = 8000
- 8000 - 5000 = 3000 more bytes
- cwnd is the network limit, rwnd the receiver limit
A server restarts and bind() fails with 'Address already in use'. Why, and what fixes it?
- Old connections sit in TIME_WAIT on that port
- Set SO_REUSEADDR before bind()
Can 1000 clients connect to one server listening on port 443?
- Yes, each connection has a different 4-tuple
- The listening socket is shared; connections are not